Real-time chat app Snapchat was built to capture a moment, share it with friends, then move on. But it turns out the self-destruct function may have a fatal flaw.
Utah-based Internet safety company Decipher Forensics revealed last week that the application — which allows users to set a time limit of up to 10 seconds before their message "disappears forever" — in fact stores images away from the naked eye.
"We wanted to know if 'snaps' really do 'disappear forever,'" digital forensics examiner Richard Hickman wrote in a blog post. "If there is metadata associated with 'snaps,' if 'snaps' can be recovered after becoming expired, and if they can be recovered, if there is metadata associated with the expired 'snap.'"
Using two different Android devices (the Samsung Galaxy Note II and Galaxy S III) and three different accounts, the researchers swapped photos and videos, then sifted through the phone's innards to find the data.
The majority of it was stored within the data/data/com.snapchat.android folder, including a listing of all contacts stored on the device — a move made only with the permission of the app user. Below that, though, was a list of Snapchat messages.
"The actual app is even saving the picture," Hickman told Utah news station KSL.com. "They claim that it's deleted, and it's not even deleted. It's actually saved on the phone." The images are stored in the "received_images_snaps" folder because of the way the app is designed, according to the researchers.
The program actually adds the file extension ".NOMEDIA," in turn making the photos un-viewable to most people, but available to those who know how to find them, like Hickman.
Snapchat did not immediately respond to PCMag's request for comment. The company's vice president for communications, Mary Ritti, however, told U.S. News today that "we're really not paying much attention to it [Hickman's report]."
This isn't the first time the company - which handles more than 150 million photos per day - has been accused of secretly holding on to content. In December, Snapchat and rival Facebook Poke came under fire for locally storing copies of shared videos, which became easily accessible with a free iPhone file browser.